
Tines (VDP)
External Program
Submit bugs directly to this organization


External Program
Submit bugs directly to this organization
Tines looks forward to working with the security community to find vulnerabilities in order to keep our businesses and customers safe.
Open Scope — Accepts reports for all owned assets based on impact, even if not listed in scope.
Gold Standard Safe Harbor — Adheres to Gold Standard Safe Harbor.
Coordinated Vulnerability Disclosure — Standard coordinated vulnerability disclosure practices.
Top Response Efficiency — This program's response efficiency is above 90%.
Please use the following paths for new account signup & login:
If you are using your HackerOne email alias or the X-HackerOne-Research header as outlined in the "Test Plan" section below, you will be redirected to the listed paths:
You may also use the attached Burp Suite project setting config or add the provided ZAP replace config to your ZAP configuration.
Core Requirements:
Vulnerability Considerations:
When submitting reports on potential vulnerabilities, please consider the real-world implications of the potential vulnerability and if the report indicates real-world impact, such as privilege escalation, sensitive information disclosure, or the ability to affect resources not owned by the tenant/team they are associated with. This includes recognizing that the Tines Intelligent Workflow platform is designed to allow Tenant Owners full control over resources within their specific tenant.
Regarding the Tines run-script feature, before submitting a potential vulnerability report, please assess if the team/tenant isolation is able to be compromised or escaped from.
Documentation Resources:
Researchers must add headers to requests if not using the @wearehackerone.com email alias:
Core Ineligible Findings are out of scope.